Security is something that many advertisers ignore at their own peril.
Google Ads and other PPC platform accounts being hacked is something I hear about on a routine basis. Lucky for us and our clients, we’ve only seen a handful of hacked accounts over the years… interestingly, all of those were for Meta Ads.
But that doesn’t mean Google Ads accounts don’t get hacked just as often. I read at least once a week on the Reddit PPC sub about somebody looking for help to recover their account.
In this article I’m going to explain a number of ways you can secure your Google Ads account. But first, why do accounts get hacked and what happens when they do?
Why Hack Your Google Ads Account?
For the most part, hackers break into your Google Ads account for commercial reasons. Once in, they can use your account and credit card to run ads for nefarious purposes. For example, they might send traffic to their own affiliate sites or they might use ads to hack additional accounts… basically a PPC hacking pyramid scheme.
What Will Happen if/when you Get Hacked?
The hacker will immediately kick you out of your own account. Often this just means they add their own administrator account and delete yours. Even if you reset your stolen password, you can no longer log into your ads account as that user.
Once they’ve gained control they will typically delete all of your campaigns.
Next they will set up campaigns to do whatever bad thing they have in mind. And they won’t be shy about setting a budget to $100,000 or more per day. Assuming Google doesn’t stop them for several hours, hacked accounts can easily burn through many thousands of dollars before getting suspended.
And of course, this will be charged to your credit card.
What Does Recovering a Hacked Account Look Like?
In as few words as possible, “it ain’t pretty!”
If you’re lucky Google will suspend your account pretty quickly. Getting back into your account is almost always doable but you will need to contact Google support and the process will take several days, at least.
Once you’re back in you will need to rebuild your campaigns from scratch and your account suspension may take several weeks to clear before you can run ads again.
If you rely on Google Ads for a large porition of client leads or sales this could severely impact your business.
In addition, you will probably need to file a claim with your credit card company and wait for a replacement card.
Avoiding being hacked is very desirable.
How can You Protect Yourself?
There are several pretty straightforward things you can do to add various levels of protection to your account.
Use a Strong and Unique User Password
Create a strong password that’s difficult to guess or crack with brute force attacks. You can generate one using a password management tool… even browser based password managers have this built in now.
Don’t reuse the password you use for other accounts.
Also, you might want to use a specific user email address for your Google business stuff, separate from your personal or well-used business email address. And, use your business domain, not a @gmail.com email address to log into Google Ads if possible… more on this later.
Two-Factor Authentication
Always use this for Google Ads, and heck always use it anywhere you can. If your password is compromised hackers still won’t be able to log into your account unless they can also verify the log-in device.
If you’re not sure what this is, it’s whenever you have to perform a secondary step to log into a website… often by verifying with a code sent by text to your phone or by an authentication app.
Passkey or no Passkey?
Passkeys are a new way to log in that are more secure than traditional passwords and two-factor authentication. But right now all websites that offer passkey login still allow you to use a regular login with two-factor authentication. So this doesn’t necessarily make things more secure at the moment, just a bit more convenient.
Set Ad Accounts Email Domains
Especially if you use a business email domain (e.g. @tenthousandfootview.com), it’s a very good idea to limit users access to only those that are on that domain. This will make it much more difficult for hackers to add new users to the account. Of course they can change this setting if they happen to hack into the main owner email account.
Keep in mind, though, that “manager” account users can still be on any domain. Thus a hacker can associate a manager account to allow other users to gain access. It’s just an extra few steps, but those few minutes of extra work can make a difference if you realize what’s happening in real-time.
Lower Your Credit Card Limit
Do you really need a $100K credit line on your Visa or Mastercard? If you don’t ever use more than $20K/month I recommend lowering the limit to reduce exposure.
Remove Inactive Users and Managers
If “Gary” still has access to Google Ads and hasn’t worked for your business since 2018, you need to fix that. Likewise, you should not have any “managers” connected to your account unless those agencies or services are actively required. Nix those 3 agencies that audited your account last year!
Review Active User Access Rights
If some Google Ads users don’t need to make changes to the account you should consider setting them to “read only” access. If their account gets hacked the hackers won’t have the ability to do any harm in the account. It’s best practice to review and adjust user access on a regular basis, particularly for accounts with many users.
Avoid Phishing Scams
Always question any phone calls or emails you receive that ask you to login or provide your password. A very common hacker trick for PPC is sending you attachments you have to use your Google login/password to open. If you are already logged into your Google account you do not have to log in again to open Google attachments!
Also, some scammers run Google Ads that appear to contain the link for Google Ads. Google Ads users that routinely use Google search to find the Google Ads login link are getting hacked this way. Instead of doing this you should get into the habit of using a browser bookmark or auto complete to launch Google Ads. For the most convenience, consider placing the link on your bookmark bar for single click access.
Summary
I cannot overstate how bad having your Google Ads account hacked can be for your business. If it happens you can expect to lose use of your Google Ads account for at least several weeks. In addition, you will need to cancel your credit card and rebuild your campaigns from scratch, losing all the built up optimization you had established. The effects of this can set your business back for months.
Taking a few reasonably easy steps can dramatically reduce the likelihood of being hacked.
